CVE-2026-63421: Keystone: `graphql.maxTake` bypass with negative `take`
Summary The value of graphql.maxTake can be bypassed by providing a negative input. This can be used to exceed the developer's intended graphql.maxTake value, allowing queries to return results in excess of the graphql.maxTake value set.
Impact This affects any project relying on graphql.maxTake to bound the number of items returned per query.
Patches This issue has been patched in @keystone-6/core version 6.5.3.
If you cannot patch, you can workaround this by restricting take input values in your GraphQL queries to the bounded value, or by blocking negative values.
Credit This issue was found by Haxset's Security Scanner and validated by their team.
Other sources
Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose magnitude exceeds the configured bound. The bypass also applies to relationship queries and can return more records than the developer intended, potentially exhausting service resources. This issue is fixed in version 6.5.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@keystone-6/coreto a version that resolves this vulnerability.Fixed in 6.5.3 - Upgrade
Upgrade
@keystone-6/coreto a version that resolves this vulnerability.Fixed in 6.5.3 - Configuration
If you cannot patch to @keystone-6/core 6.5.3, workaround the bypass by restricting GraphQL `take` inputs to the bounded range implied by `graphql.maxTake`, or block negative `take` values (including for relationship queries) so negative values cannot exceed the configured bound.
Keystone GraphQL query parameter handling graphql.maxTake bypass workaround = Restrict `take` input values to the bounded value, or block negative values
Event History
Frequently Asked Questions
Which deployments are exposed?
Keystone deployments running a version earlier than 6.5.3 are affected if they expose GraphQL findMany or relationship queries to remote clients. The issue can be exploited without authentication.
What does an attacker need to do to trigger the issue?
An attacker only needs network access to the GraphQL endpoint and can submit a negative take argument whose magnitude exceeds the configured graphql.maxTake value. No privileges or user interaction are required.
Does setting graphql.maxTake protect affected versions?
No. In affected versions, the resolver compares the signed take value directly to graphql.maxTake, so a negative value can bypass the configured limit.
What is the impact of exploitation?
The bypass can return more records than intended, including through relationship queries. Large responses or queries may exhaust service resources, causing an availability impact.
What is the remediation?
Upgrade Keystone to version 6.5.3, which fixes the issue.